CVE-2026-4692

The bug is located in the Responsive Design Mode component, a developer tool used to preview websites at various screen resolutions. The vulnerability allows an attacker to escape the isolated execution environment (sandbox), which normally restricts the capabilities of malicious code. The detailed technical mechanism has not been disclosed by the manufacturer (CWE: NVD-CWE-noinfo), however, the maximum CVSS vector indicates that the attack is possible remotely, without authentication and without user interaction, and the impact extends beyond the originally isolated application context.

An attacker can gain full control over the victim's system — including access to sensitive data, ability to modify files, and disruption of system operation — by breaking out of the isolation mechanisms of the browser or mail client.

The software must be updated immediately to the following versions: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9, in which the vulnerability has been patched by the manufacturer.

Mozilla Firefox versions before 149, Mozilla Firefox ESR versions before 115.34 and before 140.9, Mozilla Thunderbird versions before 149 and before 140.9.